December 2003 - cypherpunks-legacy

Re: store your private ke
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- -=> Quoting In:bryce@digicash.com to Harka <=- In> The non-cpunks that I talk to frequently say that "no bad guys In> would bother to read my e-mail". This is a pretty good assumption, In> because it takes into account (as the cpunks themselves frequently In> fail to do) that there is a _cost_ to illicitly reading e-mail, and In> that as long as the value of reading your private e-mail is less than In> the cost of reading it, you can consider yourself safe. Another point, that most PGP-"uninitiated" (challenged? :)) people fail to realize is the non-individual-based approach to e-mail snooping. Commonly people think, that first they have to be specifically targeted by a "bad guy". But in the times of Echelon and generic key-word-based filtering of _all_ e-mails, that go through certain points (Satellite-Links etc.), nobody has to be specifically targeted anymore, because _everybody's_ e-mail is potentially read. All other things you mentioned are of course valid too besides that. Ciao Harka ... Microsoft - "Where do you want to crash today?" ___ Blue Wave/386 v2.30 [NR] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAgUBM02gpjltEBIEF0MBAQFy4wf/QIx7s1iRBDIW7VXYFWN6T5xlO2stm7QI +Cl8dz7ZL24nMazVUA+I0GqJjpjEOY7bK5oZwbELTaaD6g6unjoZLb6n5/fiXeaN Dd7LdJ989oqmUxO2fm6F/81OqPIGHQl5UwqOj0hII4AndaIwMJB/kSENXXJXXupI 7G/HWWddSnCzeuTfAzYBUeo1cpAgsBP7zTqyQsVUtoGVhgwbRsdUBX1kqcR7cEsv SX+TZZJZAs9AxTlIoQBuP4hb5/aEZnahb8myomKVY9XbMLBRdFzw6YlF2u/hHyit OqMzn12QVKkflxbMQWj3qCLARuT2wKEg6TeHUFAReSgIV1YSNV2Xsw== =Au+6 -----END PGP SIGNATURE----- If encryption is outlawed, only outlaws will have encryption...

1 0

Re: anonymous credit
by Hal Finney 17 Dec '03

17 Dec '03

Wei Dai, <weidai(a)eskimo.com>, writes: > The idea goes like this. The government announces a new series of > anonymous zero-coupon treasury bonds that mature in 10 years, backed by a > special lump-sum tax to be collected when the bonds mature. The proceeds > of the bond auction and the tax are distributed equally among everyone. > So basicly, the government forces everyone to take out a loan on the > credit market and guarantees its collection. Anyone who does not want the > loan anonymously buys treasury bonds with all of his distribution, holds > them for 10 years, redeems them at maturity and uses the proceeds to pay > off the lump-sum tax. I think this is a very intriguing idea. Let me try to spell it out in more detail with some concrete numbers. A zero-coupon bond is one with a purchase price less than its face value. After the maturation of the bond, it can be redeemed for its face value. The purchaser of such a bond is loaning money to its buyer, and he will be paid off at the end of the loan period with more money than he put in. For a ten year bond, maybe the purchase price is 1/2 its face value. A $1000 bond would be purchased for $500, and redeemed in 10 years for $1000. An "anonymous" bond would be a bearer bond, one which is sold without any record of who bought it, and which can be redeemed at maturity by whomever holds it. In the example above, the U.S. government sells, say, $1 billion worth of these 10 year zero coupon bonds. It will have to pay back $2 billion in ten years at maturity. The $1 billion in revenues is then distributed evenly to everyone in the country. Assuming a population of 250 million, each man, woman, and child gets $4. In ten years, in order to pay off the redeemed bonds, $2 billion of special taxes will be collected. This will amount to $8 per person. As Wei says, each person in the country (who doesn't participate in the bond sale) is given $4 now, and must pay $8 in ten years. In effect he is given a $4 loan, payable in ten years. If he does not want that loan, he can take his anticipated $4 and buy $4 worth of the bonds during the bond sale. This produces no gain or loss of money, but he gets the bond. Then, in ten years, he turns in his bond for $8, and uses that to pay off the $8 in taxes. He ends up without any change in his financial state, neither loaning nor borrowing money. (There is a slight complication in that at the time of the bond sale, people who want to offset their loan with a bond purchase won't yet have the loan funds to buy the bond; and at the end, people want to pay off their tax with the bond redemption, but the government can't redeem the bonds until it collects the tax. I'm not sure if this is a serious problem or not.) Now, if this picture is correct, this isn't exactly how I would have thought of an anonymous loan. The people receiving the distributed revenues from the bond sale are essentially borrowing money from the government. Every borrower is identified, and must pay back his loan in ten years via his taxes. So the loans are fully identified and not anonymous. What does happen though is that some (or most?) of the people can offset their loan by anonymously lending money (buying bonds). In effect they have borrowed money from the government, non-anonymously, but then have the option of lending all of it back, anonymously. At the end, it is impossible to know which people have retained their loans and which people have cancelled them. So you don't know who has borrowed money, and this therefore is effectivelly equivalent to an anonymous loan. > The fatal flaw, of course, is that there is no reason why the government > would want to help people get anonymous loans. Can anyone find a way to > fix this? Maybe a non-governmental body could be used in place of the government. Suppose a group of people wanted to allow some members to borrow money anonymously. For example, a church group wants to help members through tough times via loans, but they don't want the recipients to be identified and bear the stigma of needing charity. Wei's idea could still be used: the church sells its own bonds, redeemable at some future date for more than the face value. The funds from the sale are distributed evenly to all members. Members who don't want to borrow make purchases at least equal to their receipts. Then, after the time period, everybody has to pay a special membership fee ("tax") so that the bonds can be redeemed. If some people can't pay, the other members will have to be willing to pay more to cover their defaults. One practical problem with this idea is that the amount of money loaned per person is small compared to the volume of transactions going on, especially for large groups. In my example above, each person only anonymously borrowed $4, given $1 billion worth of transactions. That's a lot of paperwork with associated transaction costs for a small value. With smaller groups the idea might actually be more practical, although there is less anonymity then. Hal

2 1

Your Site Builder Network Membership!
by Site Builder Network 17 Dec '03

17 Dec '03

Welcome to Site Builder Network - Level 1. We went to your site(s) and found the Microsoft Internet Explorer logo and link, so your membership has been upgraded to Level 1. You now have access to the Members Only - Level 1 Lounge as well as the Members Only Download Area. Please take some time to visit http://www.microsoft.com/sbnmember/lounges/lounges.asp to see what's in store for you. Your ID and password are listed below for your convenience. Do you think you qualify for Level 2? Would you like to? The reason your Level 2 registration failed could be one of the following reasons: You are not using an ActiveX control. ====================================== To find out more about ActiveX, go to our home page at http://www.microsoft.com/sitebuilder/ and click 'Technologies' at the top of the page. Choose 'ActiveX' and you will find all kinds of ActiveX resources. Or, download the ActiveX Control Pad from the download area and add an ActiveX control to your site without a vast knowledge of html code! After you have added an ActiveX control and you are ready to upgrade your membership to Level 2, go back to http://www.microsoft.com/sbnmember/apply/apply.asp , click 'upgrade your membership' then enter your ID and password (which are listed below). This will bring up your registration information. Be sure to list the exact URL where the ActiveX control is located as well as the exact URL the IE logo is located, and we will check your site again. In the meantime, enjoy your Level 1 benefits and we will notify you of your Level 2 status within 5 days. You did not register the exact URL where the ActiveX control is located. ====================================== Our automated system can only check pages, not entire sites. Please go back to http://www.microsoft.com/sbnmember/apply/apply.asp , click 'upgrade your membership' then enter your ID and password (which is listed below). This will bring up your registration information. Be sure to list the exact URL where the ActiveX control is located as well as the exact URL the IE logo is located, and we will check your site again. In the meantime, enjoy your Level 1 benefits and we will notify you of your Level 2 status within 5 days. Once again - welcome to Level 1, and enjoy your Site Builder Network benefits. The Microsoft Site Builder Network Team ======================================== ID: 643361 Password: WRITECODE ======================================== Sites Checked: www.enter.net.mx Result: Connected OK / Link to MS Found / No ActiveX Control Found

1 0

Grouchy Old Cypherpunks
by Toto 17 Dec '03

17 Dec '03

Kent Crispin, whose sense of humor indicates he may not, after all, be a government Bot, wrote: > On Thu, Apr 10, 1997 at 12:27:29PM -0800, Timothy C. May wrote: > [...] > > By the way, I'm staying out of this latest tamper-responding device > > argument. I worked on this at Intel, actually. But I wrote a bunch of > > fairly long articles on this the 5th, or maybe it was the 7th?, time this > > came up, circa 1993. Those who refuse to learn from the threads of the past > > are condemned to repeat them. > > Let's see, to which would I rather be condemned: participating in a > lively, current discussion; or digging through musty outdated archives? I regularly cruise back through my archives of the CypherPunks list from as far back as the early 90's and I rarely find them outdated. And rather than being pretentious, I usually find them 'portentious'. > Yes, we could continually mine the archives for words of wisdom from > past participants, and thus pay them homage -- especially since it is > so painfully obvious that is what they crave. But we should forgive > them this weakness, for at some lonely age we all start wondering > about our legacy. There is, however, a far cry of difference between those to whom homage is due, and those to whom it is not. As much as I may have railed against the fascist censorship of the 'moderation experiment' badly instituted by John Gilmore, I am not ungrateful for the years of time and effort that he spent in hosting the CypherPunks list, and stated so in a post to the list before it moved on to new homes. Not knowing Tim May personally, I cannot comment on the description of him in the press as 'crusty' (not knowing if it refers to his personality or his sexual hygene), but I can see how a review of some of his recent posts might suggest that he would not be out of place in a remake of 'Grumpy Old Men'. However, his propensity for taking an attitude of 'been there, done that' (and spanking young pups on the list) in no way negates the fact that he 'has', in fact, been there and done that, and that his (somewhat vague) pointers to sources of information in regard to various list issues might prove valuable to those who have enough interest in the issue to want to indulge in a little research on the matter. While the discussions of those currently active on the list may be enlightening, there are certainly other CypherPunks (some active, some inactive) who have dealt with current issues in the past, and done so from a perspective and knowledge base that are equal or superior to those who are participating in current discussions. While Tim is certainly an icon on the list, I haven't seen any signs of senility seeping in, just yet. {From: "Timothy C. May" <tcmay(a)got.net> Subject: Has anybody seen my shoes? I lost my shoes! } (OK, maybe a couple of signs..:) While I sometimes feel that the list would be better served by more of the long-time members being a little more specific in their aide to more inexperienced members seeking information, there is no doubt that much of the input they do provide is useful enough to point those seeking a better knowledge of crypto and crypto issues in directions which can bear much fruit if the individual is sincere enough to follow their pointers. Tim's legacy is already written in CypherStone, regardless of what he may or may not do in the future, as is that of Gilmore and Hughes. Despite whatever battles you or I may engage them in, in the future, we will be telling our grandchilren, "Hey, I <spit on>/<farted at>/ <kissed> him." when the movie 'Grouchy Old CypherPunks' hits the big screen. -- Toto "One TruthMonger down, four to go"

1 0

Re: Reporters, Declan, Columns, Articles, and Angles
by Ross Wright 17 Dec '03

17 Dec '03

On or About 10 Apr 97 at 19:09, Dr.Dimitri Vulis KOTM wrote: > "Phillip M. Hallam-Baker" <hallam(a)ai.mit.edu> writes: > <doesn't matter what, 3 times> > > That's $3 for Sinn F\'ein. Thank you, Phil. > > P.S. Fuck your Queen. Free Rule for Ireland!

1 0

Re: store your private key on a multi-user system! use pubkeys without verifying them!
by Toto 17 Dec '03

17 Dec '03

Bryce wrote: > > The non-cpunks that I talk to frequently say that "no bad guys > would bother to read my e-mail". > as long as the value of reading your private e-mail is less than > the cost of reading it, you can consider yourself safe. Bad, bad assumption. > So my points are as follows: > 2. To the cpunks: the _value_ of invading your privacy is not that > high. There are no evil storm troopers whose full time job is to run > a man-in-the-middle attack on your PGP public key, or dedicate a > cracking farm to decrypting your messages, or using TEMPEST devices > on your home computer or whatever. Therefore, simply encrypting your > personal e-mail with a 512-bit PGP key, storing your private key on > your local multi-user Unix system, and using people's public keys > _without_ doing anti-Man-In-The-Middle techniques is more than > sufficient to protect your privacy. Horseshit. Send me all of the email and files from the hard drives of the NSA, CIA, FBI, and the organizations we don't know about, for the last 20 years, and then we'll talk about what evil storm troopers do, or do not, exist. Then we can begin to talk about what really trips up most fugitives/criminals/freedom-fighters--the mundane. J.Edgar Hoover didn't rise from the grave to entrap the UnaBomber with high-tech devices and an army of spooks. His own family turned him in. Four guys broke into a Vancouver bank a few years ago, spent the weekend cracking the vault and safety deposit boxes, and made a clean getaway, except one of their suitcases broke open on the trip out of town, spilling the goodies for everyone to see. They sat in jail until Monday morning, when the banks opened, and the cops could figure out who they robbed. > Now, if you use your e-mail to transmit really _valuable_ data, then > that is a different story. I submit that everyone has _really_valuable_data_, no matter what value others put on it. I would guess that there are no shortage of people who would rather have their company's data compromised, than have their spouse find their secret love-letters. The key is to be as meticulous as possible in your security precautions, because those things you have little knowledge of or control over may well be more dangerous to you than those that you don't. Case in point. I spent twenty years of my life making sure that I had extra 'butts' on me at all times, so that I would not have to face my greatest fear--going to jail without a suffiecient supply of nicotine. The one time I slipped up was when I was on 'safe' ground, in my hometown, crossing a border I had crossed every day for the last few weeks with no trouble. Then I got hauled in for a 'bad check' that was a result of a clerical error. I actually had the cancelled check in my motorhome, but the facts didn't matter--I was headed for the slam with almost no butts. An understanding Sheriff's deputy with a couple extra packs probably saved me from the death penalty for killing cops to escape and go get more butts. When you decide that you've got nothing to worry about, because the 'bad guys' aren't after you, then the 'good guys' will get you. Your wife will hire a teenage hacker to look for the secret love letters that don't exist, and turn up unrelated info that the kid will use to get a sweetheart deal when the Feds break down 'his' door. Your employer's audit of the books will point to you being a thief, and in the process of proving you innocent, will turn up evidence of your office affair, giving your spouse grounds for divorce. The people who get fucked aren't the people who 'deserved' it. They aren't the people who 'took crazy chances'. They aren't the people who 'had the most to hide'. They are the people who got fucked. The bottom line is, if you have something to hide, then hide it, and hide it well. You can be faster than a speeding bullet and leap tall buildings in a single bound, but somewhere out there is a bum going through a dumpster, and he just found a funny, glowing, green rock. -- Toto "The Xenix Chainsaw Massacre" http://bureau42.base.org/public/xenix/xenbody.html

2 1

Microsoft Site Gestapo
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

At 08:53 PM 4/10/97 -0700, you wrote: >Welcome to Site Builder Network - Level 1. > >We went to your site(s) and found the Microsoft Internet Explorer logo >and link, so your membership has been upgraded to Level 1. You now have >access to the Members Only - Level 1 Lounge as well as the Members Only >Download Area. Please take some time to visit >http://www.microsoft.com/sbnmember/lounges/lounges.asp to see what's in >store for you. Your ID and password are listed below for your >convenience. > >Do you think you qualify for Level 2? Would you like to? The reason >your Level 2 registration failed could be one of the following reasons: > >You are not using an ActiveX control. >====================================== >To find out more about ActiveX, go to our home page at Fuck you.

2 1

Re: A mini rant on IRS and Social Security
by Toto 17 Dec '03

17 Dec '03

Timothy C. May wrote: > > Many of you in the United States have probably seen the reports on how the > Social Security Administration has pulled their Web site, citing security > problems. > > I'm not naive. I knew that anything I reported to the IRS, or that my > employers reported, was accessible to those with access (Q.E.D.). I just am > surprised that my earnings for the past 28 years are "online," available > to anyone with the few bits of entropy needed to get past the minimal > security. > > This ought to be recounted far and wide. Remind your siblings, friends, and > others about this situation. Point out to them that when a society becomes > dominated by "accounts," instead of old-fashioned cash payments, then he > who controls the keys controls everything. IRS Continues Personal Privacy and Security Breeches (From the NYTimes, April 9, 1997) The IRS admitted that it has not stemmed the improper browsing of taxpayer records by nosy agents. 1,515 such cases have become known in the last two years. A study of the EARL (Electronic Audit Research Log) software program indicates that, "some employees, when encountered, indicated they browsed because they do not believe it is wrong and that there will be little consequence to them if they are caught." About 51,000 IRS employees have access to taxpayer records through the Integrated Data Retrieval System. Senator John Glenn, (D-OH) agrees, as recent court rulings have decided that these invasions of privacy are not illegal as long as the information is not given to others; as though determining that was at all possible. Senator Glenn is attempting to levy heavy fines and imprisonment for violators. The GAO has also determined, according to their recent report on these abuses, that 6,400 tapes and cartridges which "might" contain taxpayer information are also missing. -- Toto "The Xenix Chainsaw Massacre" http://bureau42.base.org/public/xenix/xenbody.html

1 0

Re: KC post per Alec
by Kent Crispin 17 Dec '03

17 Dec '03

On Thu, Apr 10, 1997 at 10:04:01PM -0600, Toto wrote: [a piece on Tim May] Toto, thanks for your thoughtful comments. Your touching defense of Tim is interesting. Contrary to what you might think, I really don't have anything against Tim May, and I do go read things he (or others) have written in the past. But I am getting to the crusty old fart stage myself... As to his legacy, and the legacy of cypherpunks in general, that remains to be seen. None of the cypherpunks are in a position to be able to judge very well, because they are so close to their favorite issues that of course they look very large. But it isn't a certainty that any of the predictions of crypto-anarchy, for example, will come to pass. It is possible that the surveillance state will win. More likely, of course, the world will go in a direction that will surprise all of us (except that Tim will tell us he considered the possibility in a paper he wrote back in the 1970s). What will look portentious and what will look pretentious 10 years from now is hard to judge... Personally, I am in favor of absolute personal privacy, but I don't define that to include economic dealings -- as far as I am concerned, business or economic privacy is at a lower level of concern than personal privacy. This puts me at odds with the prevailing libertarian bent of cypherpunks, of course. However, I was thrown off my stride by the high level of downright hostility so common on this list. Like most people, I tend to respond in kind. -- Kent Crispin "No reason to get excited", kent(a)songbird.com the thief he kindly spoke... PGP fingerprint: B1 8B 72 ED 55 21 5E 44 61 F4 58 0F 72 10 65 55 http://songbird.com/kent/pgp_key.html

1 0

Re: "...markets are fundamentally chaotic, not efficient"?
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> By that definition, markets, whether for capital or assassins, > are distinctly _not_ chaotic*, since most people's decisions > [* Unless Life, The Universe, and Everything are really > deterministic, but fate has decreed that I don't believe that...] > about what stocks to buy/sell, and particularly the timing, > are influenced by lots of random events - when they hear what information, > whether they were busy doing something else when they heard, > whether they'd just blown their disposable income on a new car > because that freak windstorm dropped a tree on their car the same > week the Post Office ate their car insurance payment, > whether Alan Greenspan had a bad pizza the night before the quarterly > interest rates came out or too much caffeine before his latest speech.... I don`t really want to get into this discussion/flame war too deeply but I will post on this thread once... Any of the events described above are completely determined by the initial conditions of the system, just because a system is too complex for us to measure its initial conditions in enough detail does not mean it is random, it simply means we see it as random. Hence a market`s behaviour is labeled chaotic, because it appears random. It is, however, completely deterministic however we cannot know the initial conditions because they are too complicated. End of chat, chaotic behaviour is NOT random, it simply appears so unless one can accurately measure the intial conditions. Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

3 2